CVE-2025-1529 is a stored cross-site scripting vulnerability in the AM LottiePlayer WordPress plugin maintained by johanaarstein. The flaw exists in all versions up to and including 3.5.3 due to improper neutralization of input during web page generation (CWE-79). Authenticated users with Author-level access or higher can upload crafted lottie files containing malicious scripts. These scripts are stored and later executed in the context of any user viewing the affected pages. The vulnerability allows injection of arbitrary web scripts because the plugin fails to sufficiently sanitize and escape input and output related to uploaded lottie files. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Author-level or higher privileges can exploit this vulnerability to inject persistent malicious scripts into pages via uploaded lottie files. These scripts execute in the browsers of users visiting the compromised pages, potentially leading to theft of sensitive information, session tokens, or other malicious actions within the user's browser context. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling or removing the AM LottiePlayer plugin if possible. Monitor for plugin updates from the vendor addressing this vulnerability.